rapid7/metasploit-framework — pull request #562 by sqlifuzzer (2012-07-03 19:55:05+00:00)
Title: added umbraco_upload_aspx.rb for Umbraco CMS 4.7.0.378

Umbraco 4.7.0 unauthenticated file upload

This module can be used to execute a payload on Umbraco CMS 4.7.0. The payload is uploaded as an ASPX script by sending a specially crafted SOAP request.

Tested on Umbraco CMS 4.7.0.378 / Microsoft Windows 7 Professional 32-bit SP1.

Described in detail here: http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-local-reference-instance.html

Testing notes:

Umbraco source is here: http://umbraco.codeplex.com/

Umbraco 4.7.0 can be obtained here: http://umbraco.codeplex.com/releases/view/62573 (look for the 'Umbraco 4.7.0 binaries' link).